Privacy notice (KVKK)
Under legal review The final text is published after sign-off. You are welcome to write to us with any questions. Contact
This text is under legal review. There is no application or interest-list form on swimupcamp.com right now; you reach our team by email or phone. The text below also covers the full version, once the forms open. The final wording will be published here when the review is done. Questions: info@frekansyuzmeokulu.com
This English text is a translation. In case of conflict, the Turkish version prevails.
Privacy Notice under Turkish Data Protection Law (Swim Up Camp)
Last updated: 19 October 2026 · Version: 2026-10-v1
1. Data controller
Swim Up Camp is a brand of Frekans Yüzme Akademisi Spor Kulübü (legal name and address details to be added after legal review), the data controller under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).
- Legal name: Frekans Yüzme Akademisi Spor Kulübü (full name to be added after legal review)
- Address: full address to be added after legal review, Çankaya / Ankara, Türkiye
- Registration and tax numbers: to be added after legal review
- Registered e-mail (KEP): to be added after legal review
- E-mail: info@frekansyuzmeokulu.com · Phone: +90 532 164 23 77
2. Scope
This notice covers: (A) the camp application form (two steps); (B) the waitlist form; (C) the interest list (new-camp announcements, confirmed by e-mail); (D) site security, bot protection and cookieless measurement; (E) the camp information form sent after your place is confirmed; (F) contact by e-mail, phone or WhatsApp. Our forms are for adults (18+) only.
3. Data, purposes and legal grounds
(A) Camp application
| Category | Data | Purpose | Legal ground (KVKK) |
|---|---|---|---|
| Identity | Full name | Receiving your application, creating your booking | Art. 5(2)(c): necessary to enter into or perform a contract |
| Contact | E-mail, phone, whether you can be reached on WhatsApp | Replying to you, sending payment and camp details | Art. 5(2)(c) |
| Suitability | Swim level, open-water experience (Open Water camps only), goals, your note, answers to additional questions, the camp and dates | Assessing whether the camp suits you; planning groups and training | Art. 5(2)(c) |
| Marketing attribution | How you heard about us; page, referrer and campaign (UTM) tags | Understanding which channels work | Art. 5(2)(f): legitimate interest |
| Declarations and consent records | “I am 18 or older”, notice-read flag, notice version, timestamps; optional marketing e-mail consent and its time | Proof of declarations and consents; legal claims; compliance with commercial e-mail rules | Art. 5(2)(ç) legal obligation; Art. 5(2)(e) establishing, exercising or defending a right |
| Transaction security | Salted, irreversible hash of your IP address; browser user agent; country; submission time; a one-time key preventing duplicates | Blocking fake and automated submissions, limiting abuse, preventing duplicates | Art. 5(2)(f) |
Please do not write health information in the note field. Health information is requested only after your place is confirmed, in a separate form with separate explicit consent.
The optional marketing e-mail box is unticked by default; your application is assessed whether or not you tick it.
(B) Waitlist
A shorter version of the application form (name, e-mail, phone, WhatsApp preference, optionally level and other fields, plus the declaration, consent and security data in (A)). Purpose: telling you, in order, when a place opens up. Legal ground: Art. 5(2)(c); security data Art. 5(2)(f).
(C) Interest list
| Data | Purpose | Legal ground |
|---|---|---|
| First name, e-mail, camp types of interest (empty = all), page language | Sending e-mail announcements when new camp dates open | Art. 5(1) explicit consent; consent for commercial electronic messages under Law No. 6563 |
| Consent records: time of ticking, time of confirming via the e-mailed link, notice version, unsubscribe time, last announcement | Proof of consent and of withdrawal | Art. 5(2)(ç), Art. 5(2)(e) |
| Security data as in (A) | Preventing abuse | Art. 5(2)(f) |
Your entry stays “pending” and receives nothing until you click the confirmation link (double opt-in). Every announcement contains a one-click unsubscribe link; you can also write to info@frekansyuzmeokulu.com.
(D) Security, bot protection and measurement
- Bot protection (Cloudflare Turnstile): loads the first time you interact with a form; processes technical signals such as IP address, browser and connection characteristics to tell humans from bots. Your IP address is passed to Cloudflare’s verification service when your form is checked. Legal ground: Art. 5(2)(f).
- Rate limiting: a salted hash of your IP is kept briefly; your raw IP is not stored in our systems.
- Visit statistics: Cloudflare Web Analytics counts page views in aggregate without cookies or local storage. To understand form completion we send our own server only non-identifying events (event name, page path, language, camp type); no name, e-mail, phone, form content, identifier or cookie. Nothing is sent if your browser signals Do Not Track or Global Privacy Control.
- Videos: YouTube videos load only when you press play, from youtube-nocookie.com; from then on Google may process data under its own privacy policy.
(E) Camp information form (confirmed participants only)
Room preference, roommate note, diet, T-shirt and cap size, arrival details: for logistics (Art. 5(2)(c)). Insurer and policy number, emergency contact: for emergencies (Art. 5(2)(c), (f)). Special category data (allergies, health declaration): to protect your health and safety and adapt training, on the basis of your separate explicit consent (Art. 6(3)(a)).
(F) Contact
When you write or call us, we process your name, contact details and the message to answer you (Art. 5(2)(c) or (f)). If you choose WhatsApp, the conversation runs on WhatsApp (Meta) infrastructure.
4. How we collect data
Electronically via the site forms when you submit them (through Cloudflare); automatically from your browser for bot protection and security; directly from you in e-mail, phone and WhatsApp conversations and in the camp information form.
5. Recipients
We do not sell your data. Recipients, only for the purposes stated: Cloudflare, Inc. (hosting, form intake, temporary queue up to 14 days, storage and backups, bot protection, cookieless analytics; USA/global); Resend (transactional and announcement e-mail; USA); Spaceship (admin panel database; server location to be stated after legal review); our business e-mail provider; WhatsApp (Meta), only if you choose it; camp partners such as venues and transport (only what logistics require); our coaching team; competent public authorities where legally required.
6. Transfers abroad
Cloudflare and Resend process data outside Türkiye (mainly the USA). As there is no adequacy decision, the legal basis for these transfers is being confirmed in the legal review; the final wording will be published here when it is done. We do not ask for your explicit consent for these transfers: they are regular, and since the 2024 amendment explicit consent is a ground only for occasional transfers.
7. Retention
Applications and waitlist entries: a limited period (the exact period will be set after legal review) from submission, then personal fields are anonymised. Confirmed participants’ contract, payment and accounting records: the period required by law. Interest list: until you unsubscribe; name and e-mail anonymised within a limited period (the exact period will be set after legal review) after; consent and withdrawal records kept for the period required by law. Unconfirmed interest entries: a limited period (the exact period will be set after legal review). Temporary queue: max. 14 days. IP hash for rate limiting: minutes. Backups: 14 days local, 30 days cloud. Camp information form incl. health data: a limited period (the exact period will be set after legal review) after the camp ends.
8. Your rights (KVKK Art. 11)
You may ask us to: learn whether your data is processed; request information about it; learn the purpose and whether it is used accordingly; know the third parties in Türkiye or abroad to which it is transferred; have it rectified; have it erased or destroyed under Art. 7; have rectification or erasure notified to recipients; object to an adverse outcome resulting solely from automated analysis; claim compensation for damage caused by unlawful processing. You can withdraw consent-based processing (e.g. the interest list) at any time, without affecting earlier processing.
9. How to apply
In writing, stating your identity and request, under the Communiqué on the Procedures and Principles of Application to the Data Controller: by signed letter to the Club’s address (to be added after legal review); by KEP (address to be added after legal review); with a secure electronic or mobile signature, or from the e-mail address registered with us, to info@frekansyuzmeokulu.com (subject: “KVKK request”). We reply free of charge within 30 days; a fee under the Board’s tariff may apply if the request involves additional cost. If your request is rejected, the answer is insufficient or not given in time, you may complain to the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of your application.
10. Changes
We may update this notice; the current version and date appear at the top. The version shown when you submitted a form is stored with your record.